SAML

Release date 2026/09/15

Bugfix

• Fixed an unreachable code path that prevented the plugin from falling back to validating the samlp:Response-level signature when the saml:Assertion was not individually signed. With validate_assertion_signature enabled, an unsigned assertion inside a signed Response is now accepted (and a Response with no valid signature on either the assertion or the root is rejected), so IdPs that sign the Response envelope rather than the assertion no longer require signature validation to be turned off. Relates to the Response-level fallback described in CVE-2026-14917.

• Fixed CVE-2026-14917 by validating the samlp:Response signature whenever an idp_certificate is configured – even when validate_assertion_signature is disabled – and logging a warning when neither is set, preventing an unauthenticated attacker from impersonating any user with a crafted unsigned SAML response, under configurations that set validate_assertion_signature to false.

• Hardened signature validation against XML Signature Wrapping. The plugin now checks that the signature Reference URI is a same-document fragment that names the ID of the element it digests and consumes, so a signature can no longer be bound to a different element than the one that provides the identity. A response whose reference URI is empty or not a same-document fragment is now rejected.

Release date 2026/08/24

Bugfix

• Hardened signature validation against XML Signature Wrapping. The plugin now checks that the signature Reference URI is a same-document fragment that names the ID of the element it digests and consumes, so a signature can no longer be bound to a different element than the one that provides the identity. A response whose reference URI is empty or not a same-document fragment is now rejected.

Release date 2026/08/10

Bugfix

• Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly, and logging a warning if misconfigured. This prevents a crafted unsigned SAML response from silently bypassing authentication when validate_assertion_signature is set to false.

Release date 2026/08/26

Bugfix

• Hardened signature validation against XML Signature Wrapping. The plugin now checks that the signature Reference URI is a same-document fragment that names the ID of the element it digests and consumes, so a signature can no longer be bound to a different element than the one that provides the identity. A response whose reference URI is empty or not a same-document fragment is now rejected.

Release date 2026/08/10

Bugfix

• Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly (and logging a warning if misconfigured), preventing a crafted unsigned SAML response from silently bypassing authentication under configurations that set validate_assertion_signature to false.

Release date 2026/08/20

Bugfix

• Hardened signature validation against XML Signature Wrapping. The plugin now checks that the signature Reference URI is a same-document fragment that names the ID of the element it digests and consumes, so a signature can no longer be bound to a different element than the one that provides the identity. A response whose reference URI is empty or not a same-document fragment is now rejected.

Release date 2026/08/10

Bugfix

• Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly (and logging a warning if misconfigured), preventing a crafted unsigned SAML response from silently bypassing authentication under configurations that set validate_assertion_signature to false.

Release date 2025/12/18

Bugfix

• Fixed an issue that caused a crash when the NameID Format was set to Unspecified.

Release date 2026/08/18

Bugfix

• Hardened signature validation against XML Signature Wrapping. The plugin now checks that the signature Reference URI is a same-document fragment that names the ID of the element it digests and consumes, so a signature can no longer be bound to a different element than the one that provides the identity. A response whose reference URI is empty or not a same-document fragment is now rejected.

Release date 2026/08/10

Bugfix

• Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly, and logging a warning if misconfigured. This prevents a crafted unsigned SAML response from silently bypassing authentication when validate_assertion_signature is set to false.

Release date 2025/11/18

Bugfix

• Fixed an issue that caused a crash when the NameID Format was set to Unspecified.

Release date 2026/02/26

Bugfix

• Fixed an issue that caused a crash when the NameID Format was set to Unspecified.

Release date 2026/08/31

Bugfix

• Hardened signature validation against XML Signature Wrapping. The plugin now checks that the signature Reference URI is a same-document fragment that names the ID of the element it digests and consumes, so a signature can no longer be bound to a different element than the one that provides the identity. A response whose reference URI is empty or not a same-document fragment is now rejected.

Release date 2026/08/10

Bugfix

• Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly (and logging a warning if misconfigured), preventing a crafted unsigned SAML response from silently bypassing authentication under configurations that set validate_assertion_signature to false.

Release date 2024/09/11

Deprecation

• Standardized Redis configuration across plugins. The Redis configuration now follows a common schema shared with other plugins.

Release date 2024/02/12

Breaking Change

• adjust the priority of the SAML plugin to 1010 to correct the integration between the SAML plugin and other consumer-based plugins

Bugfix

• support for consumer group scoping by using pdk kong.client.authenticate function

Release date 2024/05/20

Bugfix

• support for consumer group scoping by using pdk kong.client.authenticate function

Release date 2023/12/21

Breaking Change

• adjust the priority of the SAML plugin to 1010 to correct the integration between the SAML plugin and other consumer-based plugins

Release date 2023/11/08

Bugfix

• When the redis session storage is incorrectly configured, users now receive a 500 error instead of being redirected endlessly

• Reduce severity of ‘session was not found’ messages to ‘info’

Release date 2026/08/10

Bugfix

• Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly (and logging a warning if misconfigured), preventing a crafted unsigned SAML response from silently bypassing authentication under configurations that set validate_assertion_signature to false.

Release date 2024/03/21

Bugfix

• support for consumer group scoping by using pdk kong.client.authenticate function

Release date 2023/12/15

Breaking Change

• adjust the priority of the SAML plugin to 1010 to correct the integration between the SAML plugin and other consumer-based plugins

Release date 2023/10/12

Bugfix

• Reduce severity of ‘session was not found’ messages to ‘info’

Release date 2023/09/28

Bugfix

• When the redis session storage is incorrectly configured, users now receive a 500 error instead of being redirected endlessly

Release date 2023/10/12

Bugfix

• When the redis session storage is incorrectly configured, users now receive a 500 error instead of being redirected endlessly

Release date 2023/10/12

Bugfix

• Users will now receive a 500 error instead of being endlessly redirected when the Redis session storage is incorrectly configured.

Release date 2023/03/22

Bugfix

• The SAML plugin now works on read-only file systems.

• The SAML plugin can now handle the field session_auth_ttl (removed since 3.2.0.0).

Release date 2023/02/28

Feature

• These plugins now use lua-resty-session v4.0.0.

  This update includes new session functionalities such as configuring audiences to manage multiple sessions in a single cookie, global timeout, and persistent cookies.

  Due to this update, there are also a number of deprecated and removed parameters in these plugins. See the invidividual plugin documentation for the full list of changed parameters in each plugin.

  • Session changelog
  • OpenID Connect changelog
  • SAML changelog

• Session changelog

• OpenID Connect changelog

• SAML changelog

• Improved Plugin Documentation: Revised docs for the following plugins to include examples:

  • CORS
  • File Log
  • HTTP Log
  • JWT Signer
  • Key Auth
  • OpenID Connect
  • Rate Limiting Advanced
  • SAML
  • StatsD

• Improved Plugin Documentation: SAML

Bugfix

• Fixed an issue where the session_cookie_httponly parameter would always be set to true, even if it was configured as false.

Release date 2022/12/06

Feature

• Provides SAML v2.0 authentication and authorization between a service provider (Kong Gateway) and an identity provider (IdP).

• The anonymous field can now be configured as the username of the consumer. This field allows you to configure a string to use as an “anonymous” consumer if authentication fails.